Virtual Forensic Computing v5.1.1.4576 (x86-x64) | 140 MB
Information:
VFC was first launched to the forensic community in 2007. It is the original virtualisation solution for the forensic investigator. VFC saves crucial time by enabling an investigator to recreate and interact with the “digital crime scene” within a matter of seconds!
Features:
-Launch VFC directly from existing Forensic software *.
-Boot a (mounted) forensic image of a suspect’s computer from a physical drive or mounted forensic image.
-Bypass local Windows User Account passwords in seconds.
-Generic Password Reset (GPR) feature is completely separate to the legacy Password Bypass (PWB) feature and is very powerful. It works by injecting a proprietary VFC component directly into the VM. This component allows you to easily reset a local user account password or open a powerful system-level Command Prompt.
-With a powerful, game-changing exploit for Live ID accounts, GPR provides access to local and online authenticated user accounts.
-Password Bypass (PWB) routines allow immediate access to multiple user accounts on the same VM, without changing any system settings.
-VFC5 includes Password Bypass (PWB) routines for over 2,300 discrete Windows builds.
-PWB routines are continually updated via the PWB5 plugin. No need to reinstall the software for updates, just replace the PWB5.BIN database in the installation folder.
-Experience the “desktop” as seen by the original user.
-Use the VFC VM to take screen-shots of key evidence such as folder structure, evidence location, recently accessed files, browsing history, saved passwords, P2P shares and virus definitions among others.
-Use the VFC VM to record screen-capture video of key evidence to play back in court
-Interact with fully licenced software to view files and data in its native environment (e.g. Sage or QuickBooks) without the need to invest in a copy of the often-expensive or obsolete/proprietary software.
-Interact with connected devices (e.g. iPhones with inherent iTunes accounts or encrypted USB drives).
-Local User Account Password hashes are extracted and made available
-The provision of password hashes enables the use of external hash-cracking tools to identify the original system-password.
-This can help with programs that require EFS access
-Point-and-click option to add in additional hardware to load multiple drives into an existing VM
-Allows the user to rebuild the suspect machine as it was last viewed by them
-Supports mounted images, physical drives and now also VMDK files
-Point-and-click generation of a standalone Virtual Machine for sharing with non-technical departments.
-‘Rewind’ a VM back in time or repair it using Restore Point Forensics
-Supports GPT formatted disks.
-Support for Windows 3.1 – Windows 10.
-Additional support for Linux and SunSolaris.
-32-bit and 64-bit versions (VFC5 only)
-Heavy investment in R&D resulting in regular updates.
-Full phone and email support.System Requirements:
PC running Windows 7 SP1 or later *
1024×768 resolution display or higher
Minimum 100MB free space (in practice lots more will be required for VMs)
VMware Workstation Pro/Player v12 or later
Full Admin permissions to install VFC and mount/unmount images
VFC Mount (provided) or appropriate third-party mount tool
USB port (for dongle)
